Heimdal Assistance and Support Help Center home page

Articles in this section

Haven't Tried Heimdal Yet?

Start Free Trial 30-day Free Trial. Offer valid only for companies.

HEIMDAL Security API 2.0

Last updated

HEIMDAL Security enables you to easily access data about your endpoints, view detected threats, application deployments, and more. To obtain all that, we provide API endpoints that you can use to ingest data available in our HEIMDAL Dashboard into any desired SIEM tool.

To access the HEIMDAL API section, log in to the HEIMDAL Dashboard, click on the Guide tab -> Your Heimdal API Key mini-tab. Your Personal API Key can be generated in the Guide -> Your Personal API Key section. If you don't have an active Personal API Key, you can generate one in the Guide section -> Your Heimdal API Key. In case you need to delete the existing Personal API Key, you can press the Delete button and generate a new Personal API Key. 

1. API 2.0 authentication
2. API 2.0 configuration
3. API 2.0 endpoints

API 2.0 AUTHENTICATION

The API 2.0 endpoints allow you to retrieve data available in the HEIMDAL Dashboard (via GET, POST, and PUT methods) for each HEIMDAL product in JSON format. The data can be filtered using the parameters described below and accessed with your Personal API Key (added to the Authentication header as the Bearer or OAUTH2 authentication type). Access to the API endpoints is only possible from the IP addresses/ranges that are marked as trusted for your HEIMDAL Dashboard user account (within the Accounts section).
your_api.PNG
For each HTTP request to the Heimdal Security API, you must provide your Personal API Key in the HTTP header Authorization: "Authorization: Bearer Your-Personal-API-Key".

Curl

curl -H "Authorization: Bearer USP5MERX4PRNZ3FU7RMYUTBL52ASIORN" "https://dashboard.heimdalsecurity.com/api/heimdalapi/2.0/activeclients?customerId=229584&startDate=2021-04-03T12:00&endDate=2021-05-03T11:59&pageNumber=1&pageSize=1000"

API 2.0 CONFIGURATION

The Heimdal API v2.0 endpoints are typically structured by module. The base URL depends on your specific HEIMDAL Dashboard environment (e.g., PROD or RC). A typical GET request to fetch data (e.g., Device Info details) follows this pattern:

Component Description Example
Method HTTP Verb GET, POST, PUT
Base URL Dashboard https://dashboard.heimdalsecurity.com/api/heimdalapi/2.0
Endpoint Module Path /activeclients
Parameters Query Filters customerId=123&startDate=2024-01-01T10:10:10&endDate=2024-02-01T10:10:10

Command query parameters:

  • customerId: (Required) Your unique customer identification number.
  • startDate / endDate: Filters results within a specific timeframe (Format: YYYY-MM-DDTHH:MM:SS).
  • optional_parameter: Specific filters like hostname, email, or status.

Example:

curl -H "Authorization: Bearer YOUR_API_KEY" \
"https://dashboard.heimdalsecurity.com/api/heimdalapi/2.0/activeclients?customerId=9999"

Expected output (JSON Response)
The API returns data in JSON format. A successful request will return a 200 OK status code with a response body structured as follows:

{
 "result": [
   {
     "id": "307508",
     "hostname": "WORKSTATION-01",
     "os": "Windows 11",
     "agentVersion": "4.2.0",
     "status": "Active",
     "lastSeen": "2024-12-17T10:00:00"
   }
 ],
 "status": "RanToCompletion",
 "isCompletedSuccessfully": true
}

API 2.0 limitations and standard parameters

To ensure high availability and optimal performance across our infrastructure, the HEIMDAL API enforces the following usage policies:

  • Rate Limiting: The API allows up to 10 requests per minute, per endpoint, per API key, per customer ID.
  • Granularity: Limits are applied at a fine-grained level to enable flexible integration. Throttling is calculated per API Key, per Customer ID, and per Route. For partners or resellers, this means that limits are isolated to each specific customer environment and product "source," preventing high usage in one area from impacting others.
  • Pagination: To facilitate efficient data retrieval, the default page size is 1,000 records per page (previously 100), reducing the total number of round-trips required for large datasets.

The following parameters are used across most data retrieval requests in the Heimdal API.

Parameter Mandatory Description Default value Format example
customerId Yes The unique ID of the customer whose data is being queried. N/A 12345
startDate No The start date and time for the filtering interval. 31 days before the current date (00:00:00) YYYY-MM-DDTHH:MM:SS or
YYYY-MM-DDTHH:MM:SSZ (e.g., 2024-12-01T00:00:00)
endDate No The end date and time for the filtering interval. Current date and time YYYY-MM-DDTHH:MM:SS or
YYYY-MM-DDTHH:MM:SSZ (e.g., 2024-12-01T00:00:00)
pageNumber No Used for paginated queries to specify which page of results to return. 1  
pageSize No Used for paginated queries to specify the number of items per page. 1000  

Note: If you exceed the rate limit, the API will return a 429 Too Many Requests HTTP status code. We recommend implementing a retry logic with exponential backoff to handle these instances gracefully.

API ENDPOINTS

Customers' details

This API endpoint retrieves information about a specific customer or all customers of a reseller. It works only if you have a Dashboard reseller/admin/super admin role and you specify the customer's or the reseller's ID as the customerId value.

Field Details
Endpoint customers
Required parameters customerId
Optional parameters pageNumber — The page number for paginated queries. If missing, it will default to 1.
pageSize — The page size for paginated queries. If missing, it will default to 1000. Maximum value is 1000.
URL {{baseUrl}}/customers?customerId={{customerId}}&pageNumber={{pageNumber}}&pageSize={{pageSize}}
Output 
{
    "items": [
        {
            "id": 229584,
            "name": "HEIMDAL Support Team",
            "customerType": "Corp",
            "licenseType": "DNS-N,DNS-E,VM,IM,AV,REP,PEDM,AC,ESEC,EFP,RD,PASM",
            "splaLicense": "No",
            "purchasedLicenses": 100
        }
    ],
    "totalCount": 1,
    "pageNumber": 1,
    "pageSize": 1000
}

Device Info details

This API endpoint retrieves information about all the active clients of a customer (id, hostname, IP Address, Agent version, OS, current Group Policy, Last seen, active modules, status).

Field Details
Endpoint activeclients
Required parameters customerId
Optional parameters startDate — The start date and time for the filtering interval.
endDate — The end date and time for the filtering interval.
pageNumber — The page number for paginated queries. If missing, it will default to 1.
pageSize — The page size for paginated queries. If missing, it will default to 1000. Maximum value is 1000.
clientInfoId
URL {{baseUrl}}/activeclients?customerId={{customerId}}&startDate={{startDate}}&endDate={{endDate}}&pageNumber={{pageNumber}}&pageSize={{pageSize}}
Output 
{
    "items": [
        {
            "id": 743907,
            "hostname": "SUPPORT1",
            "username": "Test",
            "ipAddress": "10.0.2.52",
            "externalIp": "5.2.145.131",
            "version": "4.5.0.2000",
            "currentGroupPolicy": "3rd Party Patch Management",
            "selectedGroupPolicyId": 39299,
            "lastSeen": "2024-12-12T18:11:27.843+00:00",
            "modules": "ThirdParty Applications,Infinity Management,Scripting",
            "status": "Active",
            "machineType": "Endpoint",
            "operatingSystem": "Microsoft Windows 10 Enterprise - x64",
            "motherboardSerial": "6123-2686-6273-8851-1549-0354-63",
            "motherboardSerialSecondary": "6123-2686-6273-8851-1549-0354-63",
            "hddSerial": "",
            "previousGroupPolicy": "",
            "lastPolicyChange": "0001-01-01T00:00:00+00:00"
        }
    ]
}

Device Info hardware details 

This API endpoint retrieves information about the hardware specifications of an endpoint. This request works only when specifying the clientInfoId of an endpoint. It does not list all endpoints in one request. 

Field Details
Endpoint activeclients/getDeviceInfo
Required parameters customerId 
clientInfoId — Used when specifying the clientInfoId of an endpoint (required parameter). Does not list all endpoints in one request.
Optional parameters pageNumber — The page number for paginated queries. If missing, it will default to 1.
pageSize — The page size for paginated queries. If missing, it will default to 1000. Maximum value is 1000.
URL {{baseUrl}}/activeclients/getDeviceInfo?customerId={{customerId}}&clientInfoId={{clientInfoId}}
Output 
{
    "items": [
        {
            "clientInfoId": 3138602,
            "chassisType": "Desktop",
            "osVersion": "10.0.19045.0",
            "osBuild": "19045",
            "fullOsVersion": "22H2 (OS Build 19045.6466)",
            "osEdition": "Pro",
            "osServicePack": "",
            "biosVersion": "VRTUAL - 1 | Hyper-V UEFI Release v4.1 | Microsoft - 100032",
            "biosManufacturer": "Microsoft Corporation",
            "motherboardManufacturer": "Microsoft Corporation",
            "motherboardModel": "Virtual Machine",
            "systemModel": "Virtual Machine",
            "processorModel": "AMD Ryzen 7 3700X 8-Core Processor",
            "processorCoresNo": 1,
            "processorUtilization": 4,
            "memoryCapacity": 2,
            "memoryUtilization": 79,
            "hddCapacity": 99,
            "hddUtilization": 0,
            "vdfVersion": "1.443.170.0",
            "vdfTimestamp": "2025-12-17T02:01:24+00:00",
            "lastReboot": "2025-12-11T07:52:54.7155955+00:00",
            "repVersion": "",
            "appControlVersion": "",
            "dnsInfos": [
                {
                    "adapterName": "Ethernet",
                    "dnsAddresses": "10.0.2.1",
                    "isDnsAutomatic": true,
                    "physicalAddress": "00155D015F67"
                }
            ]
        }
    ],
    "totalCount": 1,
    "pageNumber": 1,
    "pageSize": 1000
}

Windows Group Policies

This API endpoint retrieves a paginated list of all Windows Group Policies configured for the specified customer tenant, returning key details such as policy IDs and policy names.

Field Details
Endpoint groupPolicy/getWindowsPolicies
Required parameters customerId
Optional parameters pageNumber — The page number for paginated queries. If missing, it will default to 1.
pageSize — The page size for paginated queries. If missing, it will default to 1000. Maximum value is 1000.
URL {{baseUrl}}/groupPolicy/getWindowsPolicies?customerId={{customerId}}&pageNumber=1&pageSize=1000
Output 
{
    "items": [
        {
            "id": 26509,
            "name": "Default"
        },
        {
            "id": 32519,
            "name": "Privilege Elevation and Delegation Management"
        },
        {
            "id": 39297,
            "name": "Next-Gen Antivirus with XTP"
        }
    ]
}

Linux Group Policies

This API endpoint retrieves a paginated list of all Linux Group Policies configured for the specified customer tenant, returning key details such as policy IDs and policy names.

Field Details
Endpoint groupPolicy/getLinuxPolicies
Required parameters customerId
Optional parameters pageNumber — The page number for paginated queries. If missing, it will default to 1.
pageSize — The page size for paginated queries. If missing, it will default to 1000. Maximum value is 1000.
URL {{baseUrl}}/groupPolicy/getLinuxPolicies?customerId={{customerId}}&pageNumber=1&pageSize=1000
Output 
{
    "items": [
        {
            "id": 26509,
            "name": "Default"
        },
        {
            "id": 32519,
            "name": "Privilege Elevation and Delegation Management"
        },
        {
            "id": 39297,
            "name": "Next-Gen Antivirus with XTP"
        }
    ]
}

macOS Group Policies

This API endpoint retrieves a paginated list of all macOS Group Policies configured for the specified customer tenant, returning key details such as policy IDs and policy names.

Field Details
Endpoint groupPolicy/getMacPolicies
Required parameters customerId
Optional parameters pageNumber — The page number for paginated queries. If missing, it will default to 1.
pageSize — The page size for paginated queries. If missing, it will default to 1000. Maximum value is 1000.
URL {{baseUrl}}/groupPolicy/getMacPolicies?customerId={{customerId}}&pageNumber=1&pageSize=1000
Output 
{
    "items": [
        {
            "id": 26509,
            "name": "Default"
        },
        {
            "id": 32519,
            "name": "Privilege Elevation and Delegation Management"
        },
        {
            "id": 39297,
            "name": "Next-Gen Antivirus with XTP"
        }
    ]
}

DNS Security Network Statistics

This API endpoint retrieves DNS Security - Network statistics for a specified customer tenant. The returned data includes key network query details such as hostname, IP address, accessed domain, threat type, protocol, query status, and timestamp.

Field Details
Endpoint threatPreventionNetwork
Required parameters customerId
Optional parameters startDate — The start date and time for the filtering interval.
endDate — The end date and time for the filtering interval.
pageNumber — The page number for paginated queries. If missing, it will default to 1.
pageSize — The page size for paginated queries. If missing, it will default to 1000. Maximum value is 1000.
hostname — Allows you to specify the hostname.
ipAddress — Allows you to specify an IP address.
status — Filter by query status: all (shows all queries for the last 24 hours), passed (shows passed queries for the last 24 hours), blocked, manualblocked, or categoryBlocked.
URL {{baseUrl}}/threatPreventionNetwork?customerId={{customerId}}&startDate={{startDate}}&endDate={{endDate}}&pageNumber={{pageNumber}}&pageSize={{pageSize}}
Output 
{
    "items": [
        {
            "hostname": "N/A",
            "ipAddress": "5.2.145.131",
            "domain": "onedscolprdfrc03.francecentral.cloudapp.azure.com",
            "threatType": "-",
            "protocol": "UDP",
            "status": "Passed",
            "timestamp": "2025-12-17T13:40:16+00:00"
        },
        {
            "hostname": "N/A",
            "ipAddress": "5.2.145.131",
            "domain": "onedscolprdcus23.centralus.cloudapp.azure.com",
            "threatType": "-",
            "protocol": "UDP",
            "status": "Passed",
            "timestamp": "2025-12-17T13:40:16+00:00"
        }
    ]
}

DNS Security Endpoint Statistics

This API endpoint retrieves DarkLayer Guard (DNS Security - Endpoint) statistics for a specified customer tenant within a given date range. The returned data provides detailed traffic insights, including hostnames, IP addresses, active usernames, accessed domains, threat types, process names (threatToProcessCorrelation), executable file paths, resolved IPs and domains, protocols, timestamps, and query status. Results can be filtered using the optional status parameter (analyzed, blocked, or allowed).

Field Details
Endpoint darklayerguard
Required parameters customerId
Optional parameters startDate — The start date and time for the filtering interval.
endDate — The end date and time for the filtering interval.
pageNumber — The page number for paginated queries. If missing, it will default to 1.
pageSize — The page size for paginated queries. If missing, it will default to 1000. Maximum value is 1000.
clientInfoId
status — Filter by query status (analyzed, blocked, or allowed).
URL {{baseUrl}}/darklayerguard?customerId={{customerId}}&startDate={{startDate}}&endDate={{endDate}}&pageNumber={{pageNumber}}&pageSize={{pageSize}}
Output 
{
    "items": [
        {
            "clientInfoId": 1840275,
            "hostname": "ROMY",
            "ip": "192.168.0.180",
            "activeUsername": "Romy",
            "domain": "acrobat.adobe.com",
            "threatType": "-",
            "threatToProcessCorrelation": "chrome.exe",
            "threatToProcessCorrelationPath": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
            "resolvedIps": "104.117.76.88 | 104.117.76.115 | 104.117.76.75 | 104.117.76.83",
            "resolvedDomains": "acrobat.adobe.com.i.edgekey.net | e29329.dsca.akamaiedge.net",
            "protocol": "IPv6",
            "timestamp": "2024-12-31T12:00:34+00:00",
            "status": "Allowed"
        }
    ]
}

DNS Security Endpoint - Full logging

This API endpoint retrieves full logging statistics for DNS Security - Endpoint for a specified customer tenant within a given date range. The returned data provides detailed inspection details per request, including client IDs, hostnames, public IP addresses, accessed domains, execution states, threat types, threat categories, protocols, process names, process paths, active usernames, resolved IPs, canonical names (cNames), and timestamps. You can filter results using optional query parameters such as clientInfoId, domain, and status (allowed, blocked, or categoryBlocked).

Field Details
Endpoint tpefulllogging
Required parameters customerId
clientInfoId
Optional parameters startDate — The start date and time for the filtering interval.
endDate — The end date and time for the filtering interval.
pageNumber — The page number for paginated queries. If missing, it will default to 1.
pageSize — The page size for paginated queries. If missing, it will default to 1000. Maximum value is 1000.
domain — Filter by accessed domain.
status — Filter by status (allowed, blocked, or categoryBlocked).
URL {{baseUrl}}/tpefulllogging?customerId={{customerId}}&endDate={{endDate}}&pageNumber={{pageNumber}}&pageSize={{pageSize}}&clientInfoId={{clientInfoId}}
Output 
{
    "items": [
        {
            "clientInfoId": 1840275,
            "hostname": "ROMY",
            "publicIp": "86.120.252.232",
            "domain": "treatment.grammarly.com",
            "state": "Excluded",
            "blocked": false,
            "threatType": "-",
            "threatCategory": "-",
            "protocol": "IPv6",
            "processName": "-",
            "processPath": "-",
            "activeUsername": "Romy",
            "ips": "-",
            "cNames": "-",
            "timestamp": "2025-12-17T13:42:38+00:00"
        }
    ]
}

DNS Security - VectorN Network

This API endpoint retrieves VectorN Detection (network-level threat detection) statistics for a specified customer tenant within a given date range. It returns detected traffic pattern matches, including hostnames and pattern IDs, to help identify potential malware communication or IOCs. You can also filter the results using optional query parameters: hostname and patternId.

Field Details
Endpoint vectorn/getNetworkMatches
Required parameters customerId
Optional parameters startDate — The start date and time for the filtering interval.
endDate — The end date and time for the filtering interval.
pageNumber — The page number for paginated queries. If missing, it will default to 1.
pageSize — The page size for paginated queries. If missing, it will default to 1000. Maximum value is 1000.
hostname — Filter by hostname.
patternId — Filter by pattern ID.
URL {{baseUrl}}/vectorn/getNetworkMatches?customerId={{customerId}}&startDate={{startDate}}&endDate={{endDate}}&pageNumber={{pageNumber}}&pageSize={{pageSize}}
Output 
{
    "items": [],
    "totalCount": 0,
    "pageNumber": 1,
    "pageSize": 1000
}

DNS Security - VectorN Endpoint

This API endpoint retrieves VectorN Detection (endpoint-level threat detection) statistics for a specified customer tenant within a given date range. It returns AI-based traffic pattern recognition matches detected on endpoints, including client IDs and pattern IDs, to help spot hidden malware, HIPS/HIDS events, and IOA/IOC capabilities. You can also filter the results using optional query parameters: clientInfoId and patternId.

Field Details
Endpoint vectorn/getEndpointMatches
Required parameters customerId
Optional parameters startDate — The start date and time for the filtering interval.
endDate — The end date and time for the filtering interval.
pageNumber — The page number for paginated queries. If missing, it will default to 1.
pageSize — The page size for paginated queries. If missing, it will default to 1000. Maximum value is 1000.
clientInfoId — Filter by endpoint ID.
patternId — Filter by pattern ID.
URL {{baseUrl}}/vectorn/getEndpointMatches?customerId={{customerId}}&startDate={{startDate}}&endDate={{endDate}}&pageNumber={{pageNumber}}&pageSize={{pageSize}}
Output 
{
    "items": [],
    "totalCount": 0,
    "pageNumber": 1,
    "pageSize": 1000
}
DNS Security - VectorN Patterns

This API endpoint retrieves VectorN Detection malware pattern statistics for a specified customer tenant within a given date range. The returned data provides insights into detected malware strains, pattern descriptions, associated risk levels, hostnames, infection probabilities, triggering processes, process types, match counts, and timestamps. You can filter the results using the optional probabilityOfInfection query parameter (none, moderate, high, or veryhigh).

Field Details
Endpoint vectorn/getMalwarePatterns
Required parameters customerId
Optional parameters pageNumber — The page number for paginated queries. If missing, it will default to 1.
pageSize — The page size for paginated queries. If missing, it will default to 1000. Maximum value is 1000.
probabilityOfInfection — Filter by probability of infection (none, moderate, high, or veryhigh).
URL {{baseUrl}}/vectorn/getMalwarePatterns?customerId={{customerId}}&pageNumber={{pageNumber}}&pageSize={{pageSize}}
Output 
{
    "items": [
        {
            "id": 1,
            "name": "Infostealer strain",
            "description": "Same time of day in the course of a month.",
            "risk": "Moderate"
        },
        {
            "id": 2,
            "name": "APT strain",
            "description": "Same time of hour in the course of a day.",
            "risk": "High"
        },
        {
            "id": 4,
            "name": "Botnet strain",
            "description": "Same time of day in the course of a month.",
            "risk": "Moderate"
        }
    ]
}

3rd Party Patch Management statistics (Windows)

This API endpoint retrieves information about third-party applications deployed across the customer tenant's endpoints within a given date range. The returned data includes details such as client IDs, application names, current versions, previous versions, update status, release dates, timestamps, CVE details, and CVSS scores. You can also filter the results using optional query parameters: clientInfoId and status (latest, update, vulnerable, patched, or uninstalled).

Field Details
Endpoint thirdParty
Required parameters customerId
Optional parameters startDate — The start date and time for the filtering interval.
endDate — The end date and time for the filtering interval.
pageNumber — The page number for paginated queries. If missing, it will default to 1.
pageSize — The page size for paginated queries. If missing, it will default to 1000. Maximum value is 1000.
clientInfoId — Filter by endpoint ID.
status — Filter by status (latest, update, vulnerable, patched, or uninstalled).
URL {{baseUrl}}/thirdParty?customerId={{customerId}}&startDate={{startDate}}&endDate={{endDate}}&pageNumber={{pageNumber}}&pageSize={{pageSize}}
Output 
{
    "items": [
        {
            "clientInfoId": "3096227",
            "software": "Google Chrome x64",
            "version": "131.0.6778.205",
            "previousVersion": "-",
            "status": "Up to date",
            "releaseDate": "0001-01-01T00:00:00+00:00",
            "timestamp": "2024-12-24T19:44:38.853+00:00",
            "cve": null,
            "cvss": null
        },
        {
            "clientInfoId": "3096227",
            "software": "Mozilla Firefox en-US x64",
            "version": "133.0.3",
            "previousVersion": "132.0.2",
            "status": "Up to date",
            "releaseDate": "0001-01-01T00:00:00+00:00",
            "timestamp": "2024-12-24T19:44:38.853+00:00",
            "cve": null,
            "cvss": null
        }
    ]
}

3rd Party Patch Management statistics (Linux)

This API endpoint retrieves information about third-party application patch statuses deployed across Linux endpoints in the customer environment.

Field Details
Endpoint linuxThirdParty
Required parameters customerId
Optional parameters startDate — The start date and time for the filtering interval.
endDate — The end date and time for the filtering interval.
pageNumber — The page number for paginated queries. If missing, it will default to 1.
pageSize — The page size for paginated queries. If missing, it will default to 1000. Maximum value is 1000.
clientInfoId — Filter by a specific endpoint ID.
URL {{baseUrl}}/linuxThirdParty?customerId={{customerId}}&startDate={{startDate}}&endDate={{endDate}}&pageNumber={{pageNumber}}&pageSize={{pageSize}}
Output 
{
    "items": [],
    "totalCount": 0,
    "pageNumber": 1,
    "pageSize": 1000
}

3rd Party Patch Management statistics - Intune support

This API endpoint retrieves details about third-party applications deployed in the environment (including application name, architecture, install/uninstall parameters, storage URLs, and version numbers) for integration with Microsoft Intune to push patches directly from HEIMDAL storage servers.

Field Details
Endpoint patchManagement/getIntuneApplications
Required parameters customerId
Optional parameters pageNumber — The page number for paginated queries. If missing, it will default to 1.
pageSize — The page size for paginated queries. If missing, it will default to 1000. Maximum value is 1000.
appName — Filter applications by full or partial name (case-insensitive).
URL {{baseUrl}}/patchManagement/getIntuneApplications?customerId={{customerId}}&pageNumber=1&pageSize=1000&appName={{appName}}
Output 
{
    "items": [
        {
            "applicationName": "7-zip x64",
            "publisher": "Igor Pavlov",
            "architecture": "x64",
            "patches": [
                {
                    "installArguments": "/qn /norestart ALLUSERS=1",
                    "appType": "Line-of-business app (MSI)",
                    "url": "https://heimdalprodstorage.blob.core.windows.net/patching/7z1806-x64.msi.enc",
                    "version": "18.06.00.0",
                    "useUserInstallContext": false
                },
                {
                    "installArguments": "/qn /norestart ALLUSERS=1",
                    "appType": "Line-of-business app (MSI)",
                    "url": "https://heimdalprodstorage.blob.core.windows.net/patching/7z1900-x64.msi.enc",
                    "version": "19.00.00.0",
                    "useUserInstallContext": false
                }
            ]
        }
    ]
}

Infinity Management applications

This API endpoint retrieves information about custom applications configured and deployed through the Infinity Management module.

Field Details
Endpoint infinityManagement/getApplications
Required parameters customerId
Optional parameters pageNumber — The page number for paginated queries. If missing, it will default to 1.
pageSize — The page size for paginated queries. If missing, it will default to 1000. Maximum value is 1000.
applicationId — Filter by a specific application ID.
URL {{baseUrl}}/infinityManagement/getApplications?customerId={{customerId}}&pageNumber=1&pageSize=1000&applicationId={{applicationId}}
Output 
{
    "items": [
        {
            "id": 3185,
            "name": "1 IM - Microsoft 365 Apps x64",
            "status": "NotProcessed",
            "publisher": null,
            "note": null,
            "isDeleted": false,
            "timestamp": "2025-12-09T15:22:09.44091+00:00",
            "architecture": "x64",
            "customExpressionTags": "Microsoft 365 Apps*",
            "cveProductName": null,
            "hasSupport": true
        }
    ]
}

Infinity Management patches

This API endpoint retrieves information about specific software patches deployed through the Infinity Management module.

Field Details
Endpoint infinityManagement/getPatches
Required parameters customerId
applicationId
Optional parameters pageNumber — The page number for paginated queries. If missing, it will default to 1.
pageSize — The page size for paginated queries. If missing, it will default to 1000. Maximum value is 1000.
patchId — Filter by a specific patch ID.
URL {{baseUrl}}/infinityManagement/getPatches?customerId={{customerId}}&pageNumber=1&pageSize=1000&applicationId={{applicationId}}&patchId={{patchId}}
Output 
{
    "items": [],
    "totalCount": 0,
    "pageNumber": 1,
    "pageSize": 1000
}

OS Updates (Windows)

This API endpoint retrieves information about Microsoft Windows updates deployed in the environment, including update names, KB numbers, severity levels, product categories, execution timestamps, CVEs, and CVSS scores.

Field Details
Endpoint microsoftUpdates
Required parameters customerId
Optional parameters startDate — The start date and time for the filtering interval.
endDate — The end date and time for the filtering interval.
pageNumber — The page number for paginated queries. If missing, it will default to 1.
pageSize — The page size for paginated queries. If missing, it will default to 1000. Maximum value is 1000.
clientInfoId — Filter by endpoint ID.
groupPolicyId — Filter by the current group policy on the machines. This parameter will be ignored if the clientInfoId is provided.
severity — Filter by update severity (comma-separated values: none, Low, Moderate, Important, Critical).
category — Filter by update category (comma-separated values: Critical Updates, Definition Updates, Drivers, Feature Packs, Security Updates, Service Packs, Update Rollups, Updates, Upgrades).
windowsUpdateStatus — Filter by status (installed, notinstalled, failed, pending).
URL {{baseUrl}}/microsoftUpdates?customerId={{customerId}}&startDate={{startDate}}&endDate={{endDate}}&pageNumber={{pageNumber}}&pageSize={{pageSize}}
Output 
{
    "items": [
        {
            "clientInfoId": "1840275",
            "updateName": "Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.421.1139.0) - Current Channel (Broad)",
            "kb": "2267602",
            "severity": "None",
            "products": "Microsoft Defender Antivirus",
            "categories": "Definition Updates",
            "timestamp": "2025-01-01T19:04:06.0389796+00:00",
            "windowsUpdateStatus": "Installed",
            "cve": "-",
            "cvss": 0.0
        },
        {
            "clientInfoId": "1840275",
            "updateName": "Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.421.1114.0) - Current Channel (Broad)",
            "kb": "2267602",
            "severity": "None",
            "products": "Microsoft Defender Antivirus",
            "categories": "Definition Updates",
            "timestamp": "2024-12-31T11:20:58.4764482+00:00",
            "windowsUpdateStatus": "Installed",
            "cve": "-",
            "cvss": 0.0
        }
    ]
}

OS Updates (Linux)

This API endpoint retrieves information about Linux operating system package updates deployed across endpoints in the environment.

Field Details
Endpoint linuxUpdates
Required parameters customerId
Optional parameters startDate — The start date and time for the filtering interval.
endDate — The end date and time for the filtering interval.
pageNumber — The page number for paginated queries. If missing, it will default to 1.
pageSize — The page size for paginated queries. If missing, it will default to 1000. Maximum value is 1000.
clientInfoId — Filter by endpoint ID.
URL {{baseUrl}}/linuxUpdates?customerId={{customerId}}&startDate={{startDate}}&endDate={{endDate}}&pageNumber={{pageNumber}}&pageSize={{pageSize}}
Output 
{
    "items": [],
    "totalCount": 0,
    "pageNumber": 1,
    "pageSize": 1000
}

Next-Gen Antivirus detections

This API endpoint retrieves Next-Gen Antivirus detection statistics for endpoints across the customer tenant. The returned details include infected file paths, threat categories, infection names, process names, resolution states, MD5 hashes, and timestamps.

Field Details
Endpoint vigilancedetections
Required parameters customerId
Optional parameters startDate — The start date and time for the filtering interval.
endDate — The end date and time for the filtering interval.
pageNumber — The page number for paginated queries. If missing, it will default to 1.
pageSize — The page size for paginated queries. If missing, it will default to 1000. Maximum value is 1000.
clientInfoId — Filter by endpoint ID.
resolution — Filter detections by resolution status (none, quarantinepending, deletequarantinepending, excludequarantinepending, removequarantinepending, excludepending, removeexclusionpending, deletepending, quarantined, deleted, excluded, fnotexist, errordelete, errorquarantine, errorexcludequarantine, errorremovequarantine, denyaccesspending, or deniedaccess).
URL {{baseUrl}}/vigilancedetections?customerId={{customerId}}&startDate={{startDate}}&endDate={{endDate}}&pageNumber={{pageNumber}}&pageSize={{pageSize}}
Output 
{
    "items": [
        {
            "clientInfoId": 1840275,
            "file": "c:\\users\\romy\\eicar.com",
            "threatCategory": "Virus",
            "infectionName": "Virus:DOS/EICAR_Test_File",
            "processName": "C:\\Windows\\explorer.exe",
            "status": "Infected",
            "resolution": "Quarantined",
            "md5": "44d88612fea8a8f36de82e1278abb02f",
            "timestamp": "2024-12-13T13:50:15.7218182+00:00"
        },
        {
            "clientInfoId": 1140494,
            "file": "c:\\users\\test\\desktop\\op\\0.zip",
            "threatCategory": "Password Stealer",
            "infectionName": "PWS:Win32/Fareit",
            "processName": "Unknown",
            "status": "Infected",
            "resolution": "Quarantined",
            "md5": "c526c0645c8143f82ae71fb6da2d19f4",
            "timestamp": "2024-12-08T06:08:12.2939169+00:00"
        }
    ]
}

XTP detections

This API endpoint retrieves Threat Prevention Extended (XTP) detection events, including hostnames, IP addresses, infected files, threat categories, infection names, process details, and resolution statuses.

Field Details
Endpoint xtp/getDetections
Required parameters customerId
Optional parameters startDate — The start date and time for the filtering interval.
endDate — The end date and time for the filtering interval.
pageNumber — The page number for paginated queries. If missing, it will default to 1.
pageSize — The page size for paginated queries. If missing, it will default to 1000. Maximum value is 1000.
clientInfoId — Filter by endpoint ID.
severities — Filter by alert severity (comma-separated values: informational, low, medium, high, critical).
URL {{baseUrl}}/xtp/getDetections?customerId=398982&startDate={{startDate}}&endDate={{endDate}}&pageNumber={{pageNumber}}&pageSize={{pageSize}}
Output 
{
    "items": [],
    "totalCount": 0,
    "pageNumber": 1,
    "pageSize": 1000
}

XTP rules

This API endpoint retrieves detailed information about specific Threat Prevention Extended (XTP) rules configured on the tenant.

Field Details
Endpoint xtp/getRules
Required parameters customerId 
ruleIds (comma-separated list of rule IDs to retrieve)
Optional parameters startDate — The start date and time for the filtering interval.
endDate — The end date and time for the filtering interval.
pageNumber — The page number for paginated queries. If missing, it will default to 1.
pageSize — The page size for paginated queries. If missing, it will default to 1000. Maximum value is 1000.
URL {{baseUrl}}/xtp/getRules?customerId={{customerId}}&pageNumber={{pageNumber}}&pageSize={{pageSize}}
Output 
{
    "items": [],
    "totalCount": 0,
    "pageNumber": 1,
    "pageSize": 1000
}

Ransomware Encryption Protection Statistics

This API endpoint retrieves Ransomware Encryption Protection (REP) detection statistics, returning insights into blocked malicious encryption attempts, process names, file paths, MD5 hashes, process IDs, user ownership, and execution timestamps.

Field Details
Endpoint encryptiondetection
Required parameters customerId
Optional parameters startDate — The start date and time for the filtering interval.
endDate — The end date and time for the filtering interval.
pageNumber — The page number for paginated queries. If missing, it will default to 1.
pageSize — The page size for paginated queries. If missing, it will default to 1000. Maximum value is 1000.
clientInfoId — Filter by endpoint ID.
URL {{baseUrl}}/encryptiondetection?customerId={{customerId}}&startDate={{startDate}}&endDate={{endDate}}&pageNumber={{pageNumber}}&pageSize={{pageSize}}
Output 
{
    "items": [
        {
            "clientInfoId": 3173192,
            "hostname": "SUPPORT7",
            "username": "Test",
            "processName": "CSA-Agent",
            "processPath": "C:\\Users\\Test\\Desktop\\jadi3\\CSA-Agent.exe",
            "md5": "1963407345577F2983043441E4174711",
            "processId": "7920",
            "owner": "SUPPORT7\\Test",
            "timestamp": "2026-06-18T08:14:10.3488114+00:00",
            "serverTimestamp": "2026-06-18T08:14:11.7229426+00:00"
        }
    ]
}

Privilege Elevation and Delegation Management statistics

This API endpoint retrieves information about Privilege Elevation and Delegation Management (PEDM) lifecycle elevation requests for end users across the tenant.

Field Details
Endpoint adminprivilege/getElevationsInLifecycle
Required parameters

customerId
elevationState - Filter by state: 

  • Init — Elevations that were requested and need to be approved or denied
  • Pending — Elevations that were approved and weren’t consumed yet.
  • Finalized — Elevations that were consumed.
  • Failed — Elevations that couldn’t be consumed
Optional parameters startDate — The start date and time for the filtering interval.
endDate — The end date and time for the filtering interval.
pageNumber — The page number for paginated queries. If missing, it will default to 1.
pageSize — The page size for paginated queries. If missing, it will default to 1000. Maximum value is 1000.
URL {{baseUrl}}/adminprivilege/getElevationsInLifecycle?customerId={{customerId}}&startDate={{startDate}}&endDate={{endDate}}&pageNumber={{pageNumber}}&pageSize={{pageSize}}&elevationState=
Output 
{
    "items": [
        {
            "elevationId": 4626907,
            "username": "SUPPORT8\\TestNoAP",
            "reason": "Install software",
            "requestTime": "2024-12-04T09:09:02.3814681+00:00",
            "startTime": null,
            "endTime": null,
            "elevationType": "Session",
            "fileName": "",
            "filePath": "",
            "clientInfoId": 1571680
        }
    ]
}

Privilege Elevation and Delegation Management details

This API endpoint outputs details related to the processes that were running during an active or completed privilege elevation session.

Field Details
Endpoint adminprivilege/getElevationProcesses
Required parameters customerId
Optional parameters startDate — The start date and time for the filtering interval.
endDate — The end date and time for the filtering interval.
pageNumber — The page number for paginated queries. If missing, it will default to 1.
pageSize — The page size for paginated queries. If missing, it will default to 1000. Maximum value is 1000.
elevationId — ID corresponding to the requested elevation session. Optional, but must be provided if elevationId is missing.
clientInfoId — ID of the endpoint requesting elevation. Optional, but must be provided if the clientInfoId is missing. Can be retrieved from Privilege Elevation and Delegation Management statistics.
URL {{baseUrl}}/adminprivilege/getElevationProcesses?customerId={{customerId}}&startDate={{startDate}}&endDate={{endDate}}&pageNumber={{pageNumber}}&pageSize={{pageSize}}
Output 
{
    "items": [
        {
            "elevationId": 7740359,
            "clientInfoId": 3140033,
            "processName": "npp.8.9.3.Installer.x64",
            "processFullPath": "\"C:\\Users\\TestNoAP\\Downloads\\npp.8.9.3.Installer.x64.exe\"",
            "userName": "SUPPORT9\\TestNoAP",
            "date": "2026-04-07T08:24:56.2575456+00:00"
        }
    ],
    "totalCount": 1,
    "pageNumber": 1,
    "pageSize": 1000
}

Application Control statistics

This API endpoint retrieves information about processes intercepted by the Application Control module within the specified timeframe.

Field Details
Endpoint processlock/getInterceptedProcess
Required parameters customerId
Optional parameters startDate — The start date and time for the filtering interval.
endDate — The end date and time for the filtering interval.
pageNumber — The page number for paginated queries. If missing, it will default to 1.
pageSize — The page size for paginated queries. If missing, it will default to 1000. Maximum value is 1000.
URL {{baseUrl}}/processlock/getInterceptedProcess?customerId={{customerId}}&startDate={{startDate}}&endDate={{endDate}}&pageNumber={{pageNumber}}&pageSize={{pageSize}}
Output 
{
    "items": [],
    "totalCount": 0,
    "pageNumber": 1,
    "pageSize": 1000
}

Application Control process details

This API endpoint retrieves information about a specific process intercepted by the Application Control module, filtered by file hash.

Field Details
Endpoint processlock/getDetailsForInterceptedProcess
Required parameters customerId
md5Hash — The MD5 hash of the file.
Optional parameters startDate — The start date and time for the filtering interval.
endDate — The end date and time for the filtering interval.
pageNumber — The page number for paginated queries. If missing, it will default to 1.
pageSize — The page size for paginated queries. If missing, it will default to 1000. Maximum value is 1000.
URL {{baseUrl}}/processlock/getDetailsForInterceptedProcess?customerId={{customerId}}&startDate={{startDate}}&endDate={{endDate}}&pageNumber={{pageNumber}}&pageSize={{pageSize}}&md5Hash={{md5Hash}}
Output 
{
    "hostName": "ROMY",
    "userName": "ROMY\\Romy",
    "version": "90.0.4430.212",
    "interceptedProcess": "2021-05-11T20:03:41.754+00:00",
    "groupPolicyName": "ROMY's endpoints",
    "status": "AllowByDefault"
}

Application Control raw processes

This API endpoint retrieves raw process logs intercepted by the Application Control engine across all managed endpoints.

Field Details
Endpoint processlock/getRawInterceptedProcess
Required parameters customerId
Optional parameters endDate — The end date and time for the filtering interval.
pageNumber — The page number for paginated queries. If missing, it will default to 1.
pageSize — The page size for paginated queries. If missing, it will default to 1000. Maximum value is 1000.
URL {{baseUrl}}/processlock/getRawInterceptedProcess?customerId={{customerId}}&endDate={{endDate}}&pageNumber={{pageNumber}}&pageSize={{pageSize}}
Output 
{
    "items": [
        {
            "hostname": "SUPPORT9",
            "userName": "SUPPORT9\\TestNoAP",
            "processName": "RuntimeBroker.exe",
            "fullPath": "C:\\Windows\\System32\\RuntimeBroker.exe",
            "publisher": "Microsoft Windows",
            "softwareName": "Runtime Broker",
            "version": "10.0.26100.7309 (WinBuild.160101.0800)",
            "md5": "",
            "certificate": "CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
            "groupPolicyName": "Application Control",
            "status": "AllowByDefault",
            "interceptedProcess": "2025-12-17T15:05:17+00:00"
        },
        {
            "hostname": "SUPPORT9",
            "userName": "SUPPORT9\\TestNoAP",
            "processName": "backgroundTaskHost.exe",
            "fullPath": "C:\\WINDOWS\\system32\\backgroundTaskHost.exe",
            "publisher": "Microsoft Windows",
            "softwareName": "Background Task Host",
            "version": "10.0.26100.1 (WinBuild.160101.0800)",
            "md5": "f588c66901cb6e1bc7c7b4953bc76473",
            "certificate": "CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
            "groupPolicyName": "Application Control",
            "status": "AllowByDefault",
            "interceptedProcess": "2025-12-17T15:05:16+00:00"
        }
    ]
}

TAC Customers by Parent

This API endpoint retrieves Threat Alignment Center (TAC) risk score metrics evaluated across customer accounts belonging to a reseller parent tenant.

Field Details
Endpoint tac/getCustomersByParent
Required parameters customerId
tacType — Category of TAC score (Endpoints, Users, ExernalFirewall).
Optional parameters startDate — The start date and time for the filtering interval.
endDate — The end date and time for the filtering interval.
URL {{baseUrl}}/tac/getCustomersByParent?customerId={{customerId}}&startDate={{startDate}}&endDate={{endDate}}&tacType=Endpoints
Output 
{
    "items": [],
    "totalCount": 0,
    "pageNumber": 1,
    "pageSize": 1000
}

TAC Device Notifications

This API endpoint retrieves Threat Alignment Center (TAC) security alerts and notifications triggered across managed endpoints.

Field Details
Endpoint tac/getNotifications
Required parameters customerId
Optional parameters

startDate — The start date and time for the filtering interval.
endDate — The end date and time for the filtering interval.
pageNumber — The page number for paginated queries. If missing, it will default to 1.
pageSize — The page size for paginated queries. If missing, it will default to 1000. Maximum value is 1000.
clientInfoId — Filter by endpoint ID.
severities — Filter by severities. Can be one of the following:

  • Informational — Filter to show detections with informational severity.
  • Low — Filter to show detections with low severity.
  • Medium — Filter to show detections with medium severity.
  • High — Filter to show detections with high severity.
  • Critical — Filter to show detections with critical severity.

sources — Filter by sources. Can be one of the following:

  • Xtp — Filter to show detections from XTP module.
  • VectorN — Filter to show detections from VectorN module.
  • Patching — Filter to show detections from Patching module.
  • WindowsUpdate — Filter to show detections from WindowsUpdate module.
  • Antivirus — Filter to show detections from Antivirus module.
  • RansomwareEncryptionProtection — Filter to show detections from REP module.
  • PrivilegedAccessManagement — Filter to show detections from PEDM module.
  • AppControl — Filter to show detections from App Control module.
  • EmailSecurity — Filter to show detections from Email Security module.
  • EmailFraudPrevention — Filter to show detections from Email Fraud Prevention module.

resolutions  — Filter by resolutions. Can be one of the following:

  • unresolved — Filter to show detections with unresolved resolution.
  • resolved — Filter to show detections with resolved resolution;
  • actioned — Filter to show detections with actioned resolution.
  • underInvestigation — Filter to show detections with under investigation resolution.
URL {{baseUrl}}/tac/getNotfications?customerId={{customerId}}&startDate={{startDate}}&endDate={{endDate}}&pageNumber={{pageNumber}}&pageSize={{pageSize}}
Output 
{
    "items": [
        {
            "clientInfoId": "3461569",
            "hostname": "SERVER1",
            "name": "Microsoft severity rating - informational",
            "details": "Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.449.122.0) - Current Channel (Broad)",
            "processName": "-",
            "pid": "-",
            "categories": [
                "Vulnerability Management"
            ],
            "resolution": "Resolved",
            "severity": "Informational",
            "source": "WindowsUpdate",
            "ruleId": 1551,
            "timestamp": "2026-04-15T20:58:44.4070705+00:00",
            "lastUpdated": "2026-04-15T22:39:03.5276696+00:00"
        },
        {
            "clientInfoId": "3334946",
            "hostname": "SUPPORT5",
            "name": "Heimdal uninstalled",
            "details": "Hostname SUPPORT5 has uninstalled Heimdal Thor Agent",
            "processName": "-",
            "pid": "-",
            "categories": [
                "Endpoint Detection"
            ],
            "resolution": "Actioned",
            "severity": "Critical",
            "source": "EndpointOperationalIssues",
            "ruleId": 1696,
            "timestamp": "2026-04-23T10:08:30.4585749+00:00",
            "lastUpdated": "2026-04-23T10:26:12.526522+00:00"
        }
    ]
}

TAC Device Risk Scores

This API endpoint retrieves Threat Alignment Center (TAC) risk score metrics evaluated for individual device endpoints.

Field Details
Endpoint tac/getRiskScores
Required parameters customerId
clientInfoId — Filter by endpoint ID.
Optional parameters startDate — The start date and time for the filtering interval.
endDate — The end date and time for the filtering interval.
URL {{baseUrl}}/tac/getRiskScores?customerId={{customerId}}&startDate={{startDate}}&endDate={{endDate}}&clientInfoId={{clientInfoId}}
Output 
{
    "items": [
        {
            "riskScore": 30.0
        }
    ]
}

TAC M365 Notifications

This API endpoint retrieves Threat Alignment Center (TAC) notifications and security alerts related to Microsoft 365 user accounts.

Field Details
Endpoint tac/getUserNotifications
Required parameters customerId
Optional parameters

startDate — The start date and time for the filtering interval.
endDate — The end date and time for the filtering interval.
pageNumber — The page number for paginated queries. If missing, it will default to 1.
pageSize — The page size for paginated queries. If missing, it will default to 1000. Maximum value is 1000.
userPrincipalName — Filter by target M365 user principal name.
severities — Filter by severities. Can be one of the following:

  • Informational — Filter to show detections with informational severity.
  • Low — Filter to show detections with low severity.
  • Medium — Filter to show detections with medium severity.
  • High — Filter to show detections with high severity.
  • Critical — Filter to show detections with critical severity.

sources — Filter by sources. Can be one of the following:

  • LoginAnomalyDetection — Filter to show detections from XTP module.
  • EmailSecurity — Filter to show detections from Email Security module.
  • EmailFraudPrevention — Filter to show detections from Email Fraud Prevention module.
  • RansomwareEncryptionProtectionCloud — Filter to show detection from REP-C module.
  • M365EmailForwardRule — Filter to show detection from FW-R module.
  • M365SecurityIssues — Filter to show detection from SEC-I module.
  • EndpointOperationalIssues — Filter to show detection from OP-I module.

resolutions  — Filter by resolutions. Can be one of the following:

  • unresolved — Filter to show detections with unresolved resolution.
  • resolved — Filter to show detections with resolved resolution;
  • actioned — Filter to show detections with actioned resolution.
  • underInvestigation — Filter to show detections with under investigation resolution.
URL {{baseUrl}}/tac/getUserNotifications?customerId={{customerId}}&startDate={{startDate}}&endDate={{endDate}}&pageNumber={{pageNumber}}&pageSize={{pageSize}}
Output 
{
    "items": [
        {
            "userPrincipalName": "test@centiumtest.com",
            "name": "Fwd Rule - TestNewRule",
            "details": "Emails sent to test@centiumtest.com are forwarded to test@gmail.com",
            "categories": [
                "User Management Alert"
            ],
            "resolution": "Unresolved",
            "severity": "High",
            "source": "M365EmailForwardRule",
            "timestamp": "2026-04-16T03:00:12.4086475+00:00",
            "alertTimestamp": "0001-01-01T00:00:00+00:00",
            "lastUpdated": "0001-01-01T00:00:00+00:00"
        },
        {
            "userPrincipalName": "sierra-test1@centiumtest.com",
            "name": "MFA disabled",
            "details": "User sierra-test1@centiumtest.com has MFA disabled",
            "categories": [
                "User Management Alert"
            ],
            "resolution": "Unresolved",
            "severity": "Critical",
            "source": "M365SecurityIssues",
            "timestamp": "2026-05-06T02:03:46.017315+00:00",
            "alertTimestamp": "0001-01-01T00:00:00+00:00",
            "lastUpdated": "0001-01-01T00:00:00+00:00"
        }
    ]
}

TAC M365 Risk Scores

This API endpoint retrieves calculated Threat Alignment Center (TAC) risk scores for Microsoft 365 user accounts.

Field Details
Endpoint tac/getUserRiskScores
Required parameters customerId
userPrincipalName — Filter by user principal name.
Optional parameters startDate — The start date and time for the filtering interval.
endDate — The end date and time for the filtering interval.
URL {{baseUrl}}/tac/getUserRiskScores?customerId={{customerId}}&startDate={{startDate}}&endDate={{endDate}}&userPrincipalName={{userPrincipalName}}
Output 
{
    "items": [
        {
            "riskScore": 100.0
        }
    ]
}

TAC External Firewall Notifications

This API endpoint retrieves Threat Alignment Center (TAC) alert notifications originating from connected external firewall devices.

Field Details
Endpoint tac/getExternalFirewallNotifications
Required parameters customerId
Optional parameters

startDate — The start date and time for the filtering interval.
endDate — The end date and time for the filtering interval.
pageNumber — The page number for paginated queries. If missing, it will default to 1.
pageSize — The page size for paginated queries. If missing, it will default to 1000. Maximum value is 1000.
deviceName — Filter by device name.
severities — Filter by severities. Can be one of the following:

  • Informational — Filter to show detections with informational severity.
  • Low — Filter to show detections with low severity.
  • Medium — Filter to show detections with medium severity.
  • High — Filter to show detections with high severity.
  • Critical — Filter to show detections with critical severity.

sources — Filter by sources. Can be one of the following:

  • Xtp — Filter to show detections from XTP module.
  • VectorN — Filter to show detections from VectorN module.
  • Patching — Filter to show detections from Patching module.
  • WindowsUpdate — Filter to show detections from WindowsUpdate module.
  • Antivirus — Filter to show detections from Antivirus module.
  • RansomwareEncryptionProtection — Filter to show detections from REP module.
  • PrivilegedAccessManagement — Filter to show detections from PEDM module.
  • AppControl — Filter to show detections from App Control module.
  • EmailSecurity — Filter to show detections from Email Security module.
  • EmailFraudPrevention — Filter to show detections from Email Fraud Prevention module.

resolutions  — Filter by resolutions. Can be one of the following:

  • unresolved — Filter to show detections with unresolved resolution.
  • resolved — Filter to show detections with resolved resolution;
  • actioned — Filter to show detections with actioned resolution.
  • underInvestigation — Filter to show detections with under investigation resolution.
URL {{baseUrl}}/tac/getExternalFirewallNotifications?customerId={{customerId}}&startDate={{startDate}}&endDate={{endDate}}&pageNumber={{pageNumber}}&pageSize={{pageSize}}
Output 
{
    "items": [],
    "totalCount": 0,
    "pageNumber": 1,
    "pageSize": 1000
}

TAC External Risk Scores

This API endpoint retrieves Threat Alignment Center (TAC) risk score metrics for integrated external firewalls.

Field Details
Endpoint tac/getExternalFirewallRiskScores
Required parameters customerId
deviceName — Filter by firewall device name.
Optional parameters startDate — The start date and time for the filtering interval.
endDate — The end date and time for the filtering interval.
URL {{baseUrl}}/tac/getExternalFirewallRiskScores?customerId={{customerId}}&startDate={{startDate}}&endDate={{endDate}}&deviceName={{deviceName}}
Output 
{
    "items": [],
    "totalCount": 0,
    "pageNumber": 1,
    "pageSize": 1000
}

AUDIT logs

This API suite retrieves detailed audit log entries tracking configuration and policy changes applied across your managed environment.

Log category Method Endpoint eath Required parameters Optional parameters
Windows GP Audit GET /api/heimdalapi/2.0/auditLogs/getWindowsSettingsAuditLogs customerId startDate, endDate, pageNumber, pageSize
Linux GP Audit GET /api/heimdalapi/2.0/auditLogs/getLinuxSettingsAuditLogs customerId startDate, endDate, pageNumber, pageSize
macOS GP Audit GET /api/heimdalapi/2.0/auditLogs/getMacSettingsAuditLogs customerId startDate, endDate, pageNumber, pageSize
Network Settings GET /api/heimdalapi/2.0/auditLogs/getNetworkSettingsAuditLogs customerId startDate, endDate, pageNumber, pageSize
Device Info Audit GET /api/heimdalapi/2.0/auditLogs/getClientInfoAuditLogs customerId startDate, endDate, pageNumber, pageSize
Global Audit Logs GET /api/heimdalapi/2.0/auditLogs/getGlobalAuditLogs customerId startDate, endDate, pageNumber, pageSize

Haven't Tried Heimdal Yet?

Start Free Trial 30-day Free Trial. Offer valid only for companies.